Rule 124, Rule 126 and CIRT: who type-approves AIS-189/190 in India

The question every homologation manager asks

Before the engineering, before the evidence, there is a procedural question that decides your whole plan: who type-approves this in India, and where does the cybersecurity file go? For AIS-189 and AIS-190, the answer runs through the Central Motor Vehicles Rules — and, in practice, through CIRT.

This page is written for the person who owns that answer: the homologation manager at an OEM, a Tier-1 or a Tier-2 who has to get a vehicle or a component approved and cannot afford to discover the venue late.

CIRT's designation, in its own words

CIRT — the Central Institute of Road Transport, Pune — describes itself precisely: a "Testing & Certification agency notified under CMVR Rule 124 & Rule 126, Ministry of Road Transport & Highways, Government of India." Two rules, one institution, and a direct line to the ministry that owns the type-approval regime. That designation is the foundation everything else on this page rests on.

• Rule 126 of the CMVR, 1989 names the test agencies to which a manufacturer may submit a prototype for type approval — the list that answers "who is authorised to test a vehicle for type approval in India?"
• Rule 124 is the companion type-approval and certification provision under which those agencies are notified to test and certify against the applicable standards.

Read together, Rules 124 and 126 are the statutory route from a prototype to a type-approval certificate, and CIRT is notified under both.

Five agencies — and what makes CIRT distinct

The principal automotive test agencies are five: ARAI (Pune), ICAT (Manesar), VRDE (Ahmednagar), CIRT (Pune) and GARC (Chennai), with further specialised bodies for tractors and fuels. The list is not fixed for all time; it has grown by statutory notification as India's testing infrastructure expanded. CIRT — established in 1967 — was added to Rule 126 by G.S.R. 276(E) dated 10 April 2007.

What sets CIRT apart among the five is its parent ministry. The others sit under different arms of government; CIRT functions directly under the Ministry of Road Transport & Highways — the very ministry that writes the CMVR and drives the AIS-189/190 mandate through MoRTH draft G.S.R. 503(E). For a homologation manager, that alignment is not cosmetic: the assessment venue and the rule-maker share a ministry.

Where the cybersecurity file goes: CIRT

For the cybersecurity standards specifically, CIRT is a type-approval authority for AIS-189 and AIS-190. That is the fact a homologation manager needs, because a CSMS or SUMS assessment is not a bench test of a physical property — it is an assessment of an organisation's management system, its threat analysis, and its evidence. It needs an agency that is both notified under the CMVR and competent in automotive cybersecurity.

India's standard makes that competence requirement explicit. AIS-189 clause 5.3.1 requires the assessing agency to hold automotive cybersecurity and risk-assessment competence of its own — so two conditions have to be met:

Question	Answered by
May this agency test and certify a prototype?	CMVR Rule 124 & Rule 126 (the notification)
Is this agency competent to assess a CSMS/SUMS?	AIS-189 clause 5.3.1 (the competence bar)

CIRT clears both. Its automotive-cybersecurity function is led by Farukh S Makhdoom, Head — Automotive Cybersecurity & MDC at CIRT — a dedicated cybersecurity assessment capability inside a notified type-approval agency, which is exactly the combination AIS-189 clause 5.3.1 is written to require. We treat the competence clause itself in AIS-189 clause 5.3.1.

Why this matters for programme planning

For a homologation manager mapping a submission, positioning CIRT correctly removes a whole class of risk:

• One institutional route. The cybersecurity file does not have to detour to a different kind of body — it runs through a notified CMVR agency, alongside the rest of the type approval.
• Assessment, not just a bench test. Expect the CSMS/SUMS assessment to run beside the classic prototype test — it is an assessment of processes and evidence, on its own track, granted through the same certification mechanism.
• Competence is settled, so plan the evidence. Because CIRT holds the AIS-189 competence scope, the open variable is your readiness, not the venue. The work is to arrive with an assessable CSMS and SUMS — scope, gap assessment, TARA, processes, evidence — as set out in the AIS-189/190 readiness checklist.

Where CIRT, ARAI and ICAT actually divide the submission-to-certificate workflow, and where the cybersecurity assessment fits within it, is the subject of CIRT, ARAI, ICAT: how an Indian type approval actually gets assessed.

The enforcement clock behind all of this

The reason this is live now, not later, is the enforcement timeline. AIS-189 and AIS-190 are carried into mandatory force by MoRTH draft G.S.R. 503(E) (17 June 2026), which inserts CMVR Rules 125-T and 125-U with a phased schedule from October 2026. That draft is not yet finalised in the gazette — the full status is in India's automotive cybersecurity timeline — but the direction is set, and the venue for the assessment is already clear.

The AutoSifu view

AutoSifu works this route with the approval body in the room. CIRT is a CMVR-notified Testing & Certification agency, a type-approval authority for AIS-189 and AIS-190, the one of the five that sits directly under MoRTH, and our strategic partner — so an OEM, Tier-1 or Tier-2 we work with takes its CSMS and SUMS to a genuinely competent assessment, prepared alongside the people who will assess it. For a homologation manager, that is the shortest honest path from a prototype to a certificate: the venue is settled, and the work is the evidence.